Opening the case

There are two screws at the bottom of the device, under the rubber feet.

The rest of the case is kept together by latches at the every side of the device.

Start prying near the grill with a flat screwdriver.

Pictures are taken from Archer C9 page, but the case is nearly identical

Serial

Once the lid is off, remove 2 screws to get the PCB out and then flip it over to find silkscreened holes UARTP (3.3V), TX, RX. Find yourself a suitable GND hole. In case you do not wish to solder headers to those holes, you can use slightly bent pin headers: a strip of 2 for TX/RX and a strip of 3 with the middle pin removed for GND 4/+1V (only used as a way to keep the header in place).

Original Firmware root access - for debugging purposes

When logged in to the web interface, go to Advanced/Wireless/Wireless Settings.
Choose 2.4 GHz or 5GHz (better use the one, you don't need). Enter the following string as your Wireless Network Name (SSID):

$(killall telnetd)

then klick “Save” and wait until it finishes.
Repeat the procedure to start telnet with a shell.

$(/usr/sbin/telnetd -l /bin/sh)

then klick “Save”

Then telnet to 192.168.1.1 or whatever IP you have assigned to the router.
The amount of available commands is very limited: no grep, no find, no mtd, …